October 22, 2026
If you work in IT auditing, cybersecurity, risk or information systems, you may have come across the Certified Information Systems Auditor (CISA) certification.
Offered by ISACA, CISA is designed for professionals whose work involves auditing, monitoring, controlling and assessing information technology and business systems.
But earning the certification involves more than simply passing an exam. Before you register, it helps to understand what the CISA exam covers, how the certification process works and how to prepare effectively.
CISA stands for Certified Information Systems Auditor. The certification focuses on the skills involved in auditing, controlling, monitoring and assessing an organization's information technology and business systems.
CISA has been offered since 1978, and more than 200,000 professionals have earned the certification worldwide.
For professionals working where technology, security, risk and business operations intersect, CISA provides a way to demonstrate knowledge across several important areas of information systems auditing.
Despite the word "auditor" in the name, CISA isn't relevant only to people with "IT Auditor" on their business cards.
The knowledge covered by CISA can be relevant to professionals working in areas such as:
If your work involves questions such as Are our systems properly controlled? Are our information assets protected? Are technology risks being managed? then the subject matter covered by CISA may already sound familiar.
The CISA exam contains 150 questions covering five job-practice domains. Candidates have four hours to complete the exam.
The current domains are:
This includes audit planning, audit standards, risk-based auditing, controls, evidence collection, testing, data analytics and reporting.
This covers areas such as IT governance and strategy, enterprise risk management, privacy, data governance, policies, vendor management and IT performance.
Topics include project governance, system development, controls, implementation, migration and post-implementation review.
This includes IT operations, asset management, incident and change management, databases, backups, business continuity and disaster recovery.
This covers information security controls, identity and access management, encryption, cloud environments, security testing, monitoring and incident response.
The percentages reveal something important about the exam: CISA isn't simply a cybersecurity test. Candidates need to understand how technology, controls, risk, governance and business objectives work together.
The CISA exam requires more than memorizing terminology.
Candidates need to understand concepts well enough to apply them to different situations. ISACA also advises candidates to pay close attention to wording such as MOST and BEST when answering questions. Several answers may initially seem reasonable, but the task is to identify the most appropriate response.
That makes practice questions particularly useful.
Instead of simply asking yourself, Do I know this concept?, try asking:
Why is this the best answer? What risk is being addressed? What should an auditor consider first?
Learning to apply what you know can be just as important as learning the material itself.
A good starting point is the current CISA Exam Content Outline. It tells you how the exam is divided and can help you identify where you need to spend your study time.
Don't assume that professional experience means every domain will be equally familiar. Someone with a strong cybersecurity background, for example, may need to spend more time on auditing or governance concepts.
As you prepare:
With 150 questions to answer, spending too long on difficult questions can create problems later in the exam. ISACA does not apply a penalty for incorrect answers, so candidates should answer every question.
There is an important distinction between taking and passing the CISA exam and actually becoming CISA certified.
You can take the exam before satisfying the professional experience required for certification.
To become CISA certified, candidates must pass the exam and meet ISACA's professional experience requirements. ISACA currently requires at least five years of professional information systems auditing, control or security work experience, subject to its applicable requirements. Candidates must apply for certification within five years of passing the exam.
If you're planning your CISA path, make sure you understand both the exam requirements and the separate certification requirements.
Unlike an exam offered only a few times each year, CISA registration is available continuously.
After registering and paying for the exam, candidates receive an eligibility period in which they must schedule and take it. CISA exams are administered through PSI, and eligible candidates use the PSI scheduling system to choose their appointment.
Before scheduling, check available testing locations and dates. You should also make sure the name on your ISACA account matches the identification you will present on exam day.
Don't leave scheduling until the last minute. Giving yourself enough time provides more flexibility when choosing a date and testing location.
CISA is offered as a computer-based exam through authorized PSI testing centres as well as through remote proctoring.
The right choice depends on how you prefer to take an important exam.
Remote testing may be convenient for some candidates. Others prefer a dedicated test centre where they don't need to worry about their own computer, internet connection or home testing environment.
Think about where you're most likely to stay focused and comfortable for a four-hour examination.
Once you've spent weeks or months preparing, don't let a simple administrative issue interfere with your exam.
Before your appointment:
Knowing what to expect can make test day feel much more manageable.
If you're ready to write your CISA exam in Vancouver, Ashton Testing Services provides professional in-person exam administration in downtown Vancouver.
After putting the work into preparing for CISA, choose a testing environment where you can concentrate on the exam.
Book your CISA exam at Ashton Testing Services and come ready to focus.
Resources
For the latest requirements, exam information and preparation materials, refer to ISACA's official resources: